Analysis

  • max time kernel
    147s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/05/2023, 21:04

General

  • Target

    285dd4a90419f041fd06721fa01e04ee24619115520973959a41580f92345bc2.exe

  • Size

    1.1MB

  • MD5

    5108d1aa9f94b5e8511554f066c8abf9

  • SHA1

    538eb5a1a13aa143176af5bb9e2b3b0c326a5ade

  • SHA256

    285dd4a90419f041fd06721fa01e04ee24619115520973959a41580f92345bc2

  • SHA512

    84db650daed460ee4ddfe4b19c5440e412c1fe9fba8897481d1506ebaee0244d68a658659861fc1b7a67401de6b984cbed712cdbe5a509edc044852ed334fba6

  • SSDEEP

    24576:5yWaWc/2fRCDtPLxexwgdRS7El4q02yzNaeQl:sWNc/eAD99EwgdRBl4/DxaeQ

Malware Config

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\285dd4a90419f041fd06721fa01e04ee24619115520973959a41580f92345bc2.exe
    "C:\Users\Admin\AppData\Local\Temp\285dd4a90419f041fd06721fa01e04ee24619115520973959a41580f92345bc2.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3208
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ql372603.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ql372603.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1512
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\lg221493.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\lg221493.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1860
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uS189755.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uS189755.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1316
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\162592481.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\162592481.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:8
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\241487610.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\241487610.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4568
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 1076
              6⤵
              • Program crash
              PID:4388
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\379154022.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\379154022.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1760
          • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
            "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3740
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
              6⤵
              • Creates scheduled task(s)
              PID:4380
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4528
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                  PID:1916
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "oneetx.exe" /P "Admin:N"
                  7⤵
                    PID:1988
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "oneetx.exe" /P "Admin:R" /E
                    7⤵
                      PID:3100
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      7⤵
                        PID:4180
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\cb7ae701b3" /P "Admin:N"
                        7⤵
                          PID:3480
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\cb7ae701b3" /P "Admin:R" /E
                          7⤵
                            PID:3644
                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\409817184.exe
                    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\409817184.exe
                    3⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious use of WriteProcessMemory
                    PID:4504
                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\409817184.exe
                      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\409817184.exe
                      4⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5068
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\505132491.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\505132491.exe
                  2⤵
                  • Executes dropped EXE
                  PID:4376
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4568 -ip 4568
                1⤵
                  PID:4444
                • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
                  C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
                  1⤵
                  • Executes dropped EXE
                  PID:2024
                • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
                  C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
                  1⤵
                  • Executes dropped EXE
                  PID:2108

                Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\505132491.exe

                        Filesize

                        136KB

                        MD5

                        100a9d616da8dbb82fd696af48f1891e

                        SHA1

                        ca5011879625e02ef42b732232885c736d30fbd0

                        SHA256

                        307c15e07a61de6f9d9c4cbf949504460d8f1725e812c97ca2aa8656180bd18e

                        SHA512

                        0f8f3271c8a466502da57f6f2e126f96e3cca594334242f700d900dafad856120206353e77896e49b3f12a50193e4e4b78c6a8ba7529cb4dfea18e97909a70c5

                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\505132491.exe

                        Filesize

                        136KB

                        MD5

                        100a9d616da8dbb82fd696af48f1891e

                        SHA1

                        ca5011879625e02ef42b732232885c736d30fbd0

                        SHA256

                        307c15e07a61de6f9d9c4cbf949504460d8f1725e812c97ca2aa8656180bd18e

                        SHA512

                        0f8f3271c8a466502da57f6f2e126f96e3cca594334242f700d900dafad856120206353e77896e49b3f12a50193e4e4b78c6a8ba7529cb4dfea18e97909a70c5

                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ql372603.exe

                        Filesize

                        940KB

                        MD5

                        b9cee902879cb0ab9b803baa6c0aa3ed

                        SHA1

                        992a82f754a7b869dba8ec1010a268865f48497a

                        SHA256

                        9d52281747c415dca95dfe0ceb56e7ca0b4c28b16f75eb2d15305df925d9e300

                        SHA512

                        d10fb913d6336af70b1203809b66cd6bf1a51b1761a3f00774f5ac81722db7a7efd50e716aa5b283c0b065a5a87668e6f3e888e9c829141b2dc6ab4b16858b56

                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ql372603.exe

                        Filesize

                        940KB

                        MD5

                        b9cee902879cb0ab9b803baa6c0aa3ed

                        SHA1

                        992a82f754a7b869dba8ec1010a268865f48497a

                        SHA256

                        9d52281747c415dca95dfe0ceb56e7ca0b4c28b16f75eb2d15305df925d9e300

                        SHA512

                        d10fb913d6336af70b1203809b66cd6bf1a51b1761a3f00774f5ac81722db7a7efd50e716aa5b283c0b065a5a87668e6f3e888e9c829141b2dc6ab4b16858b56

                      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\409817184.exe

                        Filesize

                        342KB

                        MD5

                        01aae099788c63323f055299e0444e9f

                        SHA1

                        de955d223c8a382b2a6e2fd9e833676b131f24ca

                        SHA256

                        3dadf003a870328d9a3a369a786a2fa350ec3bfc2ca2bf45fc01b94f708868fc

                        SHA512

                        bf9cdf82700873e6c8905072a19e5c965072ae304c4d8b6718f26632b714d74338b986a3af987639404dbd238a6e8e52e4b1446369f998c180bf65fb0101a654

                      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\409817184.exe

                        Filesize

                        342KB

                        MD5

                        01aae099788c63323f055299e0444e9f

                        SHA1

                        de955d223c8a382b2a6e2fd9e833676b131f24ca

                        SHA256

                        3dadf003a870328d9a3a369a786a2fa350ec3bfc2ca2bf45fc01b94f708868fc

                        SHA512

                        bf9cdf82700873e6c8905072a19e5c965072ae304c4d8b6718f26632b714d74338b986a3af987639404dbd238a6e8e52e4b1446369f998c180bf65fb0101a654

                      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\409817184.exe

                        Filesize

                        342KB

                        MD5

                        01aae099788c63323f055299e0444e9f

                        SHA1

                        de955d223c8a382b2a6e2fd9e833676b131f24ca

                        SHA256

                        3dadf003a870328d9a3a369a786a2fa350ec3bfc2ca2bf45fc01b94f708868fc

                        SHA512

                        bf9cdf82700873e6c8905072a19e5c965072ae304c4d8b6718f26632b714d74338b986a3af987639404dbd238a6e8e52e4b1446369f998c180bf65fb0101a654

                      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\lg221493.exe

                        Filesize

                        585KB

                        MD5

                        ca24c65e33051503c6a731531eb0fcc6

                        SHA1

                        230c8f626f60511dc5d7bfae5809a23968e31c88

                        SHA256

                        fb264b98a0e496ea2b83bea6e4d8c749c74c83c3a22f917bc72da42610ab2d55

                        SHA512

                        0a80d0e2be95daa578519b901d99d5a31b40db49c85a490ff8f2f79310bc4416739f920aa618b8e888a3a29bbff43c13340624019027072bee836cad52203ce9

                      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\lg221493.exe

                        Filesize

                        585KB

                        MD5

                        ca24c65e33051503c6a731531eb0fcc6

                        SHA1

                        230c8f626f60511dc5d7bfae5809a23968e31c88

                        SHA256

                        fb264b98a0e496ea2b83bea6e4d8c749c74c83c3a22f917bc72da42610ab2d55

                        SHA512

                        0a80d0e2be95daa578519b901d99d5a31b40db49c85a490ff8f2f79310bc4416739f920aa618b8e888a3a29bbff43c13340624019027072bee836cad52203ce9

                      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\379154022.exe

                        Filesize

                        204KB

                        MD5

                        1304f384653e08ae497008ff13498608

                        SHA1

                        d9a76ed63d74d4217c5027757cb9a7a0d0093080

                        SHA256

                        2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                        SHA512

                        4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

                      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\379154022.exe

                        Filesize

                        204KB

                        MD5

                        1304f384653e08ae497008ff13498608

                        SHA1

                        d9a76ed63d74d4217c5027757cb9a7a0d0093080

                        SHA256

                        2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                        SHA512

                        4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

                      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uS189755.exe

                        Filesize

                        414KB

                        MD5

                        45e08f07f1cbc7ba074cc6ff63670fe7

                        SHA1

                        00f3cefdad552eac33e05fb1ccaacebe1c407024

                        SHA256

                        f8e4c078c82baa53d78dff1241b1170cd4af0487a57d9d409310682bc762def7

                        SHA512

                        1e3f1f0867a8743c72dd9c3a1d8e92d80cf3256a645aad795d7f3e2dc35afe323ae8ca64f7c098387def086f09bae256d4695178f42a8f6700294c1d5939a411

                      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uS189755.exe

                        Filesize

                        414KB

                        MD5

                        45e08f07f1cbc7ba074cc6ff63670fe7

                        SHA1

                        00f3cefdad552eac33e05fb1ccaacebe1c407024

                        SHA256

                        f8e4c078c82baa53d78dff1241b1170cd4af0487a57d9d409310682bc762def7

                        SHA512

                        1e3f1f0867a8743c72dd9c3a1d8e92d80cf3256a645aad795d7f3e2dc35afe323ae8ca64f7c098387def086f09bae256d4695178f42a8f6700294c1d5939a411

                      • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\162592481.exe

                        Filesize

                        175KB

                        MD5

                        3d10b67208452d7a91d7bd7066067676

                        SHA1

                        e6c3ab7b6da65c8cc7dd95351f118caf3a50248d

                        SHA256

                        5c8ae96739bd9454a59e92b5eb6965647030e87453f7c417dbd7d53ebd837302

                        SHA512

                        b86d5ff4f55c90922a890401ae4301da7e71eb5e546a82536073cc58780ce55585214cff39ec9b52f70704580ad36c1fa95ebee1515dd2e7ea313cb670f2b4df

                      • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\162592481.exe

                        Filesize

                        175KB

                        MD5

                        3d10b67208452d7a91d7bd7066067676

                        SHA1

                        e6c3ab7b6da65c8cc7dd95351f118caf3a50248d

                        SHA256

                        5c8ae96739bd9454a59e92b5eb6965647030e87453f7c417dbd7d53ebd837302

                        SHA512

                        b86d5ff4f55c90922a890401ae4301da7e71eb5e546a82536073cc58780ce55585214cff39ec9b52f70704580ad36c1fa95ebee1515dd2e7ea313cb670f2b4df

                      • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\241487610.exe

                        Filesize

                        259KB

                        MD5

                        e16ee6f02a0239418c7ddd60e10c527b

                        SHA1

                        e762cbadb724510c3f45c67c7feed3ab4b696c9a

                        SHA256

                        bcd8037f7145f5a741385c3fa06d8839a850d657dac9af7680a1a148908e9b56

                        SHA512

                        a298bcc28ac5f944730c0d2cca92f29d51f78847186eb2cba92df6b20c192f3de35264b436e118605cfbd19e1034b83ca03adbffd9649233338042cf70b4c385

                      • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\241487610.exe

                        Filesize

                        259KB

                        MD5

                        e16ee6f02a0239418c7ddd60e10c527b

                        SHA1

                        e762cbadb724510c3f45c67c7feed3ab4b696c9a

                        SHA256

                        bcd8037f7145f5a741385c3fa06d8839a850d657dac9af7680a1a148908e9b56

                        SHA512

                        a298bcc28ac5f944730c0d2cca92f29d51f78847186eb2cba92df6b20c192f3de35264b436e118605cfbd19e1034b83ca03adbffd9649233338042cf70b4c385

                      • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                        Filesize

                        204KB

                        MD5

                        1304f384653e08ae497008ff13498608

                        SHA1

                        d9a76ed63d74d4217c5027757cb9a7a0d0093080

                        SHA256

                        2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                        SHA512

                        4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

                      • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                        Filesize

                        204KB

                        MD5

                        1304f384653e08ae497008ff13498608

                        SHA1

                        d9a76ed63d74d4217c5027757cb9a7a0d0093080

                        SHA256

                        2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                        SHA512

                        4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

                      • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                        Filesize

                        204KB

                        MD5

                        1304f384653e08ae497008ff13498608

                        SHA1

                        d9a76ed63d74d4217c5027757cb9a7a0d0093080

                        SHA256

                        2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                        SHA512

                        4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

                      • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                        Filesize

                        204KB

                        MD5

                        1304f384653e08ae497008ff13498608

                        SHA1

                        d9a76ed63d74d4217c5027757cb9a7a0d0093080

                        SHA256

                        2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                        SHA512

                        4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

                      • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                        Filesize

                        204KB

                        MD5

                        1304f384653e08ae497008ff13498608

                        SHA1

                        d9a76ed63d74d4217c5027757cb9a7a0d0093080

                        SHA256

                        2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa

                        SHA512

                        4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1

                      • memory/8-172-0x0000000004950000-0x0000000004963000-memory.dmp

                        Filesize

                        76KB

                      • memory/8-174-0x0000000004950000-0x0000000004963000-memory.dmp

                        Filesize

                        76KB

                      • memory/8-188-0x0000000004950000-0x0000000004963000-memory.dmp

                        Filesize

                        76KB

                      • memory/8-192-0x0000000004950000-0x0000000004963000-memory.dmp

                        Filesize

                        76KB

                      • memory/8-180-0x0000000004950000-0x0000000004963000-memory.dmp

                        Filesize

                        76KB

                      • memory/8-193-0x0000000004A40000-0x0000000004A50000-memory.dmp

                        Filesize

                        64KB

                      • memory/8-194-0x0000000004A40000-0x0000000004A50000-memory.dmp

                        Filesize

                        64KB

                      • memory/8-195-0x0000000004A40000-0x0000000004A50000-memory.dmp

                        Filesize

                        64KB

                      • memory/8-182-0x0000000004950000-0x0000000004963000-memory.dmp

                        Filesize

                        76KB

                      • memory/8-184-0x0000000004950000-0x0000000004963000-memory.dmp

                        Filesize

                        76KB

                      • memory/8-161-0x0000000004A50000-0x0000000004FF4000-memory.dmp

                        Filesize

                        5.6MB

                      • memory/8-162-0x0000000004A40000-0x0000000004A50000-memory.dmp

                        Filesize

                        64KB

                      • memory/8-163-0x0000000004A40000-0x0000000004A50000-memory.dmp

                        Filesize

                        64KB

                      • memory/8-165-0x0000000004950000-0x0000000004963000-memory.dmp

                        Filesize

                        76KB

                      • memory/8-190-0x0000000004950000-0x0000000004963000-memory.dmp

                        Filesize

                        76KB

                      • memory/8-166-0x0000000004950000-0x0000000004963000-memory.dmp

                        Filesize

                        76KB

                      • memory/8-168-0x0000000004950000-0x0000000004963000-memory.dmp

                        Filesize

                        76KB

                      • memory/8-170-0x0000000004950000-0x0000000004963000-memory.dmp

                        Filesize

                        76KB

                      • memory/8-164-0x0000000004A40000-0x0000000004A50000-memory.dmp

                        Filesize

                        64KB

                      • memory/8-186-0x0000000004950000-0x0000000004963000-memory.dmp

                        Filesize

                        76KB

                      • memory/8-178-0x0000000004950000-0x0000000004963000-memory.dmp

                        Filesize

                        76KB

                      • memory/8-176-0x0000000004950000-0x0000000004963000-memory.dmp

                        Filesize

                        76KB

                      • memory/4376-271-0x0000000007730000-0x0000000007D48000-memory.dmp

                        Filesize

                        6.1MB

                      • memory/4376-273-0x00000000071D0000-0x00000000071E2000-memory.dmp

                        Filesize

                        72KB

                      • memory/4376-278-0x0000000007300000-0x000000000740A000-memory.dmp

                        Filesize

                        1.0MB

                      • memory/4376-291-0x0000000007230000-0x000000000726C000-memory.dmp

                        Filesize

                        240KB

                      • memory/4376-265-0x00000000004C0000-0x00000000004E8000-memory.dmp

                        Filesize

                        160KB

                      • memory/4376-340-0x0000000007290000-0x00000000072A0000-memory.dmp

                        Filesize

                        64KB

                      • memory/4376-1072-0x0000000007290000-0x00000000072A0000-memory.dmp

                        Filesize

                        64KB

                      • memory/4504-258-0x00000000007E0000-0x0000000000827000-memory.dmp

                        Filesize

                        284KB

                      • memory/4568-233-0x0000000000400000-0x0000000000455000-memory.dmp

                        Filesize

                        340KB

                      • memory/4568-236-0x00000000025E0000-0x00000000025F0000-memory.dmp

                        Filesize

                        64KB

                      • memory/4568-229-0x00000000005B0000-0x00000000005DD000-memory.dmp

                        Filesize

                        180KB

                      • memory/4568-230-0x00000000025E0000-0x00000000025F0000-memory.dmp

                        Filesize

                        64KB

                      • memory/4568-231-0x00000000025E0000-0x00000000025F0000-memory.dmp

                        Filesize

                        64KB

                      • memory/4568-232-0x00000000025E0000-0x00000000025F0000-memory.dmp

                        Filesize

                        64KB

                      • memory/4568-238-0x0000000000400000-0x0000000000455000-memory.dmp

                        Filesize

                        340KB

                      • memory/4568-237-0x00000000025E0000-0x00000000025F0000-memory.dmp

                        Filesize

                        64KB

                      • memory/4568-235-0x00000000025E0000-0x00000000025F0000-memory.dmp

                        Filesize

                        64KB

                      • memory/5068-283-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

                        Filesize

                        64KB

                      • memory/5068-1069-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

                        Filesize

                        64KB

                      • memory/5068-260-0x0000000000400000-0x0000000000449000-memory.dmp

                        Filesize

                        292KB

                      • memory/5068-281-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

                        Filesize

                        64KB

                      • memory/5068-276-0x0000000000400000-0x0000000000449000-memory.dmp

                        Filesize

                        292KB

                      • memory/5068-267-0x0000000002410000-0x0000000002445000-memory.dmp

                        Filesize

                        212KB

                      • memory/5068-1067-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

                        Filesize

                        64KB

                      • memory/5068-279-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

                        Filesize

                        64KB

                      • memory/5068-1070-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

                        Filesize

                        64KB

                      • memory/5068-1071-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

                        Filesize

                        64KB

                      • memory/5068-266-0x0000000002410000-0x0000000002445000-memory.dmp

                        Filesize

                        212KB

                      • memory/5068-1073-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

                        Filesize

                        64KB

                      • memory/5068-256-0x0000000000400000-0x0000000000449000-memory.dmp

                        Filesize

                        292KB

                      • memory/5068-259-0x0000000000400000-0x0000000000449000-memory.dmp

                        Filesize

                        292KB